Read no more than size of string with scanf()

the safest way is to use

fgets(string, 4, stdin);

here you can store maximum 3 characters including one space reserved for NULL ('\0') character.

Your array needs to be able to hold four chars, since it must also contain the 0-terminator. With that fixed, specifying a maximal length in the format,

scanf("%3s", string);

ensures that scanf reads no more than 3 characters.